# CS 259D One-Class Training for Masquerade Detection

• 背景知识与启发
• Schonlau 数据集
• 机器学习方法
• 朴素贝叶斯分类器
• 单分类 SVM
• 局限性
• 参考资料

## 背景知识与启发

• 用户行为建模
• 检测异常行为
• “伪装者”问题是一个具有挑战性的问题
• 引发假警报
• 多分类
• 每个用户的样本当作一个类别组成数据来源
• 自身与他人
• 用户加入/离开机构时需要重新训练
• 伪装的非自身用户样本会偏离模型的审查
• 单分类
• 仅用该用户的数据，为本用户构建模型
• 需要的数据少
• 分布式实施

## Schonlau 数据集

• 来自70名用户的 Unix shell 命令
• 使用 Unix acct 收集数据
• 随机选择50名用户作为入侵目标
• 20名伪装用户
• 每个用户15000个命令
• 持续数天或数月
• 前5000个命令是正常的
• 接下来的10000个命令，随机注入100个入侵块命令
• 正常和入侵块的大小：100
• 问题
• 不同用户的时段差异很大
• 每个用户的登录会话次数不同
• 每个用户的入侵块数量不同（0-24）
• 用户的工作职能未知
• acct 按照命令完成的次序记录日志

## 机器学习方法

• 学习任务
• 明确的指认伪装者，而不是特定用户

### 朴素贝叶斯分类器

• 贝叶斯定理
• 不同的命令是独立的
• 多变量伯努利模型
• Unix 下856个唯一的命令
• 每个块作为一个二进制的N维向量
• 用伯努利建模每一个维度
• 在小词汇量下表现更好
• 多项式模型
• 每个块作为N维向量
• 每个命令出现的次数作为特征
• 在大词汇量下表现更好
• 单分类朴素贝叶斯
• 仅使用用户自身的模型来计算$$p(c_i|u)$$
• 对于伪装者，假定每个命令的概率都是$$1/N$$（完全随机）
• 对伪装者不做假设
• 给定一个块 $$d$$，计算： $$p(d|{\rm self})/p(d|{\rm non-self})$$
• 设定阈值控制误报与检测率

### 单分类 SVM

• 将数据映射到高维特征空间
• 最大化分离边界
• 允许异常值，通过参数设置边缘出错的概率

## 局限性

• 使用二值特征的单分类 SVM 表现的比单分类贝叶斯和使用数值特征的单分类 SVM 要好
• 问题依旧困难，准确性有待提高
• 2-gram 特征表现更差
• 1-gram 和 2-grams 同时使用可能提高性能
• 这个系统不应被用作唯一的检测器
• 需要包含命令参数而不仅仅是命令本身

## 参考资料

• One-class Training for Masquerade Detection (2003)
• CS 259D Lecture 3

## “CS 259D One-Class Training for Masquerade Detection”的104个回复

1. I just want to say I’m all new to blogs and honestly loved your blog. Almost certainly I’m going to bookmark your website . You surely come with perfect writings. Regards for sharing with us your website page.

2. Do you have a spam problem on this site; I also am a blogger, and I was wanting to know your situation; many of us have developed some nice methods and we are looking to exchange strategies with others, please shoot me an email if interested.

3. ive got alot of free time on my hands recently, so ive decided to start blogging again, . . does anybody know any good blogging sites which are free and easy to use?? (apart from tumbr and blogger/google ). . thanks (:.

4. Hello. remarkable job. I did not anticipate this. This is a excellent story. Thanks!

5. Every person in our household is impressed that a mattress that got here in a roll with the air drew out from it can be such a pleasant mattress, however it really is.

6. HelloGreetingsHey thereHeyGood dayHowdyHi thereHello thereHi! This is my first visit to your blog! We are a groupcollectionteam of volunteers and starting a new initiativeproject in a community in the same niche. Your blog provided us valuableusefulbeneficial information to work on. You have done a marvellousoutstandingextraordinarywonderful job!

7. I need your opinion in buying a laptop..Which do you prefer?? A lenovo?? Or dell??

8. Revise after nearly two years: Mattress is actually still keeping up fantastic. Wonderful buy for a mattress without awful chemicals. That is incredibly relaxed and also looks to be actually effectively made.

9. Thanks for some other fantastic post. The place else may anyone get that type of info in such an ideal method of writing? I’ve a presentation next week, and I am on the search for such info.

10. I loved as much as you will receive carried out right here. The sketch is tasteful, your authored subject matter stylish. nonetheless, you command get bought an nervousness over that you wish be delivering the following. unwell unquestionably come further formerly again since exactly the same nearly a lot often inside case you shield this increase.

11. I’ve been surfing online more than three hours today, yet I never found any interesting article like yours. It is pretty worth enough for me. In my view, if all webmasters and bloggers made good content as you did, the web will be much more useful than ever before.

12. Hiya very nice blog!! Man .. Excellent .. Amazing .. I will bookmark your site and take the feeds also…I am happy to search out a lot of helpful info right here within the submit, we need develop more techniques on this regard, thanks for sharing.

13. Health and Fitness说道：

Merely wanna tell that this is extremely helpful, Thanks for taking your time to write this.

14. Sweet blog! I found it while surfing around on Yahoo News. Do you have any suggestions on how to get listed in Yahoo News? I’ve been trying for a while but I never seem to get there! Thank you

15. I’m very happy to read this. This is the type of manual that needs to be given and not the random misinformation that’s at the other blogs. Appreciate your sharing this best doc.

16. I’m so happy to read this. This is the kind of manual that needs to be given and not the random misinformation that’s at the other blogs. Appreciate your sharing this best doc.

17. I as well as my guys ended up reading through the great helpful hints on your web page and suddenly I had a terrible suspicion I had not expressed respect to the site owner for those techniques. These boys appeared to be as a result stimulated to learn all of them and already have pretty much been having fun with those things. Appreciation for being simply thoughtful and for obtaining this kind of wonderful subjects millions of individuals are really wanting to discover. My honest apologies for not expressing gratitude to earlier.

18. I was just seeking this information for a while. After six hours of continuous Googleing, finally I got it in your website. I wonder what is the lack of Google strategy that do not rank this type of informative sites in top of the list. Normally the top sites are full of garbage.

19. Wow! This could be one particular of the most beneficial blogs We have ever arrive across on this subject. Basically Excellent. I’m also an expert in this topic so I can understand your effort.

20. Health and Fitness说道：

I am also commenting to make you know what a impressive discovery my child encountered going through the blog. She even learned a wide variety of pieces, most notably how it is like to have a great teaching spirit to get many more clearly know specific hard to do subject matter. You really exceeded our expectations. Many thanks for providing these powerful, trusted, revealing and cool thoughts on that topic to Janet.

21. Great post. I was checking constantly this blog and I’m impressed! Very helpful information specially the last part 🙂 I care for such information much. I was looking for this particular information for a long time. Thank you and good luck.

22. Hi i’m David Fuertes and i love porn please visit my site

23. Great – I should definitely pronounce, impressed with your website. I had no trouble navigating through all the tabs and related info ended up being truly simple to do to access. I recently found what I hoped for before you know it at all. Reasonably unusual. Is likely to appreciate it for those who add forums or something, web site theme . a tones way for your customer to communicate. Excellent task.

24. I must show my love for your generosity supporting people that require guidance on this important idea. Your personal dedication to getting the solution throughout was really effective and have in most cases allowed workers like me to arrive at their goals. Your new warm and friendly guideline means this much a person like me and much more to my peers. Thank you; from everyone of us.

25. I got what you intend, thanks for putting up.Woh I am happy to find this website through google. “I would rather be a coward than brave because people hurt you when you are brave.” by E. M. Forster.

26. I like the valuable information you provide in your articles. I will bookmark your blog and check again here frequently. I am quite certain I will learn many new stuff right here! Good luck for the next!

27. Thanks a lot for sharing this with all of us you actually recognize what you are talking about! Bookmarked. Kindly additionally discuss with my website =). We will have a link change agreement among us!

28. RETS PRO reviews and information are provided within our websites. RETSPRO serves a fabulous community of developers and real estate agents who require the ultimate flexibility of their RETS output. RETS PRO wordpress plugin is the absolute best software package available for any real estate property website developer. RETSPRO was built especially for web designers to allow them with the resources to fully customize a website for any real-estate clients.

29. I think you have noted some very interesting points , appreciate it for the post.

30. I like the valuable info you provide in your articles. I’ll bookmark your weblog and check again here frequently. I am quite certain I’ll learn plenty of new stuff right here! Best of luck for the next!

31. Excellent read, I just passed this onto a colleague who was doing some research on that. And he just bought me lunch as I found it for him smile Thus let me rephrase that: Thank you for lunch! “Without friends no one would choose to live, though he had all other goods.” by Aristotle.

32. Excellent read, I just passed this onto a friend who was doing a little research on that. And he actually bought me lunch because I found it for him smile Therefore let me rephrase that: Thanks for lunch!

33. I’m not sure where you are getting your information, but great topic. I needs to spend some time learning more or understanding more. Thanks for magnificent information I was looking for this info for my mission.

34. Wow, superb weblog format! How lengthy have you ever been running a blog for? you make blogging glance easy. The entire look of your website is great, as neatly as the content material!

35. Excellent read, I just passed this onto a friend who was doing a little research on that. And he just bought me lunch because I found it for him smile So let me rephrase that: Thanks for lunch!

36. Great write-up, I am normal visitor of one’s blog, maintain up the excellent operate, and It is going to be a regular visitor for a lengthy time.

37. Usually I don’t read article on blogs, however I would like to say that this write-up very forced me to try and do it! Your writing taste has been surprised me. Thank you, very great post.

38. I like what you guys are up too. Such clever work and reporting! Carry on the excellent works guys I’ve incorporated you guys to my blogroll. I think it’ll improve the value of my site :).

39. Thank you for the good writeup. It in fact was a amusement account it. Look advanced to far added agreeable from you! However, how can we communicate?

40. Good – I should certainly pronounce, impressed with your website. I had no trouble navigating through all tabs as well as related information ended up being truly simple to do to access. I recently found what I hoped for before you know it at all. Quite unusual. Is likely to appreciate it for those who add forums or something, web site theme . a tones way for your customer to communicate. Nice task.

41. Wonderful beat ! I would like to apprentice while you amend your web site, how can i subscribe for a blog web site? The account aided me a acceptable deal. I had been a little bit acquainted of this your broadcast offered bright clear idea

42. I’ve been browsing online greater than three hours lately, yet I by no means discovered any fascinating article like yours. It is beautiful price sufficient for me. Personally, if all webmasters and bloggers made excellent content material as you probably did, the web shall be a lot more helpful than ever before. “We are not retreating – we are advancing in another Direction.” by Douglas MacArthur.

43. You actually make it seem so easy with your presentation but I find this matter to be actually something which I think I would never understand. It seems too complicated and very broad for me. I’m looking forward for your next post, I will try to get the hang of it!

44. Hello. fantastic job. I did not anticipate this. This is a fantastic story. Thanks!

45. Wow, incredible blog layout! How long have you been blogging for? you make running a blog glance easy. The whole look of your site is fantastic, as well as the content!

46. Hi, Neat post. There’s a problem along with your website in web explorer, would test this¡K IE still is the marketplace chief and a huge component to other folks will omit your wonderful writing due to this problem.

47. Keep up the fantastic piece of work, I read few blog posts on this site and I conceive that your website is very interesting and holds circles of good info .

48. I like what you guys are up also. Such smart work and reporting! Carry on the superb works guys I’ve incorporated you guys to my blogroll. I think it will improve the value of my site :).

49. I really enjoy looking at on this web site, it contains superb content. “Beware lest in your anxiety to avoid war you obtain a master.” by Demosthenes.

50. If you are going for bestmost excellentfinest contents like meI domyself, onlysimplyjust visitgo to seepay a visitpay a quick visit this websiteweb sitesiteweb page everydaydailyevery dayall the time becausesinceasfor the reason that it providesoffersgivespresents qualityfeature contents, thanks

51. I will immediately take hold of your rss feed as I can’t to find your email subscription link or e-newsletter service. Do you’ve any? Please allow me recognise so that I may subscribe. Thanks.

53. Wow, incredible weblog layout! How lengthy have you ever been blogging for? you make running a blog glance easy. The whole glance of your website is fantastic, as smartly as the content material!

54. Hiya, I’m really glad I’ve found this info. Nowadays bloggers publish only about gossips and web and this is really irritating. A good website with exciting content, this is what I need. Thank you for keeping this website, I will be visiting it. Do you do newsletters? Can’t find it.

55. I’m still learning from you, but I’m trying to achieve my goals. I certainly enjoy reading all that is written on your website.Keep the information coming. I liked it!

56. I’ve been surfing online more than 3 hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. In my view, if all website owners and bloggers made good content as you did, the web will be a lot more useful than ever before.

57. I am not sure where you’re getting your info, but good topic. I needs to spend some time learning much more or understanding more. Thanks for fantastic information I was looking for this info for my mission.

58. I am really impressed with your writing skills as well as with the layout on your blog. Is this a paid theme or did you customize it yourself? Anyway keep up the excellent quality writing, it’s rare to see a great blog like this one these days..

59. Merely wanna input on few general things, The website layout is perfect, the content material is really superb : D.

60. I happen to be commenting to let you know what a extraordinary experience my friend’s girl had reading your site. She picked up some things, most notably what it’s like to have an excellent helping heart to let the others really easily know certain complex subject matter. You truly did more than our own expected results. Many thanks for rendering those useful, healthy, explanatory and fun tips on this topic to Mary.

61. Well I sincerely enjoyed reading it. This article provided by you is very useful for proper planning.

62. Normally I do not read article on blogs, however I would like to say that this write-up very compelled me to try and do so! Your writing taste has been surprised me. Thank you, quite great post.

63. Absolutely indited content , thankyou for selective information .

64. But wanna remark that you have a very nice website , I love the style it actually stands out.

65. I intended to write you a very small observation to be able to give many thanks as before for these precious methods you have documented above. This is really unbelievably generous with you to give freely all a few people would have distributed as an electronic book to help with making some profit for their own end, notably since you might have tried it if you decided. These basics additionally worked to become fantastic way to recognize that someone else have a similar dream the same as mine to know a lot more regarding this condition. I know there are many more fun times ahead for individuals that start reading your website.

66. Generally I do not read post on blogs, but I would like to say that this write-up very forced me to take a look at and do so! Your writing style has been surprised me. Thanks, quite great article.

67. It¡¦s really a great and helpful piece of info. I am satisfied that you just shared this useful info with us. Please keep us informed like this. Thanks for sharing.

68. You completed various good points there. I did a search on the topic and found a good number of people will go along with with your blog.

69. Hi, Neat post. There’s an issue with your web site in internet explorer, could check this… IE nonetheless is the market chief and a big part of people will omit your fantastic writing because of this problem.

70. My brother suggested I might like this website. He was totally right. This post truly made my day. You cann’t imagine just how much time I had spent for this info! Thanks!

71. You made some decent points there. I did a search on the issue and found most guys will go along with with your website.

72. Very interesting topic, thank you for putting up.

73. I was suggested this web site by my cousin. I am not sure whether this post is written by him as no one else know such detailed about my problem. You’re incredible! Thanks!

74. Hello there, I discovered your blog by way of Google while searching for a related subject, your site got here up, it appears good. I’ve bookmarked it in my google bookmarks.

75. Only wanna input on few general things, The website pattern is perfect, the subject matter is real great : D.

76. Nice blog here! Also your web site loads up fast! What web host are you using? Can I get your affiliate link to your host? I wish my web site loaded up as quickly as yours lol

77. I relish, result in I discovered just what I used to be having a look for. You’ve ended my 4 day lengthy hunt! God Bless you man. Have a nice day. Bye

78. HiHello my family memberloved onefriend! I want towish to say that this articlepost is awesomeamazing, greatnice written and come withinclude almostapproximately all importantsignificantvital infos. I’dI would like to peerto seeto look moreextra posts like this .

79. Excellent beat ! I would like to apprentice while you amend your site, how could i subscribe for a blog web site? The account helped me a acceptable deal. I had been a little bit acquainted of this your broadcast provided bright clear idea

80. hi!,I like your writing so so much! share we keep in touch more approximately your article on AOL? I need an expert in this house to resolve my problem. May be that is you! Having a look forward to look you.

81. But wanna input on few general things, The website design and style is perfect, the articles is very superb. “If a man does his best, what else is there” by George Smith Patton, Jr..

82. I just couldn’t depart your website before suggesting that I really loved the standard information a person provide to your visitors? Is going to be back frequently in order to check out new posts.

83. Hello, i think that i saw you visited my weblog so i came to “return the favor”.I’m trying to find things to enhance my site!I suppose its ok to use a few of your ideas!!

84. hello!,I really like your writing so so much! percentage we keep up a correspondence extra approximately your post on AOL? I need an expert in this house to resolve my problem. Maybe that is you! Looking ahead to look you.

85. Great website. Plenty of helpful information here. I’m sending it to several pals ans additionally sharing in delicious. And naturally, thanks for your effort!

86. I have been surfing online more than three hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. In my opinion, if all web owners and bloggers made good content as you did, the internet will be a lot more useful than ever before.

87. I loved as much as you’ll receive carried out right here. The sketch is tasteful, your authored subject matter stylish. nonetheless, you command get got an edginess over that you wish be delivering the following. unwell unquestionably come more formerly again as exactly the same nearly very often inside case you shield this increase.

88. I have been browsing on-line more than three hours today, but I by no means found any interesting article like yours. It is lovely value enough for me. In my opinion, if all website owners and bloggers made good content as you did, the net might be a lot more useful than ever before. “Oh, that way madness lies let me shun that.” by William Shakespeare.

89. hello!,I really like your writing very a lot! proportion we keep in touch more approximately your article on AOL? I need an expert on this space to solve my problem. Maybe that’s you! Having a look forward to peer you.

90. Hello there, You’ve done a fantastic job. I will certainly digg it and personally suggest to my friends. I’m confident they will be benefited from this website.

91. Hey There. I found your blog using msn. This is a really well written article. I will be sure to bookmark it and come back to read more of your useful info. Thanks for the post. I’ll certainly return.

92. A person essentially assist to make severely articles I might state. That is the first time I frequented your website page and to this point? I amazed with the analysis you made to create this particular post extraordinary. Wonderful job!

93. Enjoyed looking through this, very good stuff, thankyou . “It requires more courage to suffer than to die.” by Napoleon Bonaparte.

94. Hey There. I found your blog using msn. This is a very well written article. I will be sure to bookmark it and return to read more of your useful information. Thanks for the post. I’ll certainly comeback.

95. I¡¦m no longer sure the place you’re getting your info, however good topic. I must spend some time finding out more or figuring out more. Thanks for excellent info I was in search of this information for my mission.

96. Thank you for the auspicious writeup. It in fact was a amusement account it. Look advanced to more added agreeable from you! By the way, how could we communicate?

97. I have recently started a blog, the information you offer on this web site has helped me greatly. Thank you for all of your time & work. “The man who fights for his fellow-man is a better man than the one who fights for himself.” by Clarence Darrow.

98. I do agree with all the ideas you’ve presented in your post. They are very convincing and will definitely work. Still, the posts are very quick for newbies. Could you please lengthen them a little from subsequent time? Thanks for the post.

99. Unquestionably believe that which you said. Your favorite reason seemed to be on the web the easiest thing to be aware of. I say to you, I definitely get irked while people think about worries that they just do not know about. You managed to hit the nail upon the top and defined out the whole thing without having side effect , people can take a signal. Will likely be back to get more. Thanks

100. I have recently started a web site, the information you provide on this web site has helped me tremendously. Thank you for all of your time & work. “The more sand that has escaped from the hourglass of our life, the clearer we should see through it.” by Jean Paul.

101. Hello there, You’ve done a fantastic job. I will certainly digg it and personally recommend to my friends. I am sure they’ll be benefited from this web site.

102. Hello There. I found your blog using msn. This is an extremely well written article. I’ll be sure to bookmark it and return to read more of your useful information. Thanks for the post. I will certainly comeback.

103. It¡¦s really a nice and helpful piece of info. I¡¦m satisfied that you just shared this useful information with us. Please stay us up to date like this. Thank you for sharing.